security(workflows): add least-privilege permissions blocks to all 14 workflow files

.github/workflows/call-contributor-issue-comment.yml

@@ -4,6 +4,9 @@ on:
   issue_comment:
     types: [created]
 
+permissions:
+  contents: read
+
 jobs:
   call-workflow:
     uses: learningequality/.github/.github/workflows/contributor-issue-comment.yml@main

.github/workflows/call-contributor-pr-reply.yml

@@ -2,6 +2,10 @@ name: Send reply on a new contributor pull request
 on:
   pull_request_target:
     types: [opened]
+
+permissions:
+  contents: read
+
 jobs:
   call-workflow:
     name: Call shared workflow

.github/workflows/call-manage-issue-header.yml

@@ -4,6 +4,9 @@ on:
   issues:
     types: [opened, reopened, labeled, unlabeled]
 
+permissions:
+  contents: read
+
 jobs:
   call-workflow:
     name: Call shared workflow

.github/workflows/call-pull-request-target.yml

@@ -2,6 +2,10 @@ name: Handle pull request events
 on:
   pull_request_target:
     types: [opened, review_requested, labeled]
+
+permissions:
+  contents: read
+
 jobs:
   call-workflow:
     name: Call shared workflow

.github/workflows/call-update-pr-spreadsheet.yml

@@ -3,6 +3,9 @@ on:
   pull_request_target:
     types: [assigned, unassigned, opened, closed, reopened, edited, review_requested, review_request_removed]
 
+permissions:
+  contents: read
+
 jobs:
   call-workflow:
     name: Call shared workflow

.github/workflows/community-contribution-labeling.yml

@@ -4,6 +4,9 @@ on:
   issues:
     types: [assigned, unassigned]
 
+permissions:
+  contents: read
+
 jobs:
   call-label-action:
     uses: learningequality/.github/.github/workflows/community-contribution-label.yml@main

.github/workflows/containerbuild.yml

@@ -10,6 +10,10 @@ on:
     - 'v*'
   pull_request:
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   pre_postgres:
     name: Path match check - postgres

.github/workflows/deploytest.yml

@@ -8,6 +8,10 @@ on:
     - master
   pull_request:
 
+permissions:
+  contents: read
+  actions: read
+
 jobs:
   pre_job:
     name: Path match check

.github/workflows/frontendtest.yml

@@ -8,6 +8,10 @@ on:
     - master
   pull_request:
 
+permissions:
+  contents: read
+  actions: read
+
 jobs:
   pre_job:
     name: Path match check

.github/workflows/i18n-download.yml

@@ -3,6 +3,9 @@ name: Download translations from Crowdin
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   download:
     name: Download translations and update files

.github/workflows/i18n-upload.yml

@@ -3,6 +3,9 @@ name: Upload translations to Crowdin
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   upload:
     name: Extract and upload strings to Crowdin

.github/workflows/pre-commit.yml

@@ -12,6 +12,9 @@ on:
     - hotfixes
     - master
 
+permissions:
+  contents: read
+
 jobs:
   pre_job:
     name: Path match check

.github/workflows/pythontest.yml

@@ -8,6 +8,10 @@ on:
     - master
   pull_request:
 
+permissions:
+  contents: read
+  actions: read
+
 jobs:
   pre_job:
     name: Path match check

.github/workflows/unassign-inactive.yaml

@@ -6,6 +6,9 @@ on:
     - cron: "1 0 * * 1" # Every Monday at 00:01 UTC
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   unassign-inactive:
     uses: learningequality/.github/.github/workflows/unassign-inactive-issues.yaml@main